> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/amor.md).

# Amor

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

<figure><img src="/files/rbIFbq9tzsC9crrb2DT7" alt=""><figcaption><p>(Amor) Targeted Port Scan</p></figcaption></figure>

We tried to find any exploits or shellcodes using `searchsploit` for the service versions, but there wasn't any. Our next step will be directory enumeration.

With our tool

```
ffuf-dir () {
	ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt -e .html,.php${@: 2}
}
```

we will do `ffuf-dir http://172.17.0.1/FUZZ`, but we didn't find any useful directory, so we will browse the website.

<figure><img src="/files/mGagSCGyc90gFeEF1mgX" alt=""><figcaption><p>(Amor) Web Content</p></figcaption></figure>

## 3 - Exploitation

As we can see, there is relevant info here. We have 2 potential users, Juan and Carlota, and there is an announcement talking about a weak password. We will run:

`hydra -u users.txt -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2`

We found the credentials `carlota:babygirl`, so we proceed to login through SSH. We found an image on her desktop, and nothing useful on `sudo -l`, not a single useful binary with SUID, so we suspect it could be stego.

Using `stegseek` we found a secret.txt inside that image, holding a base64 encoded string:

<figure><img src="/files/gAwEX0AQ05ry6B9NM5YH" alt=""><figcaption><p>(Amor) StegSeek and Base64</p></figcaption></figure>

## 4 - Privilege Escalation

Browsing /etc/passwd we found there is a second user on the system, `oscar`, so we try to login using that password.

He has an IMPORTANTE.txt on his Desktop, telling root to check the file on his Desktop. He also has sudo permissions as root on `/usr/bin/ruby`, so browsing GTFOBins we found this:

```
sudo ruby -e 'exec "/bin/sh"'
```

After running it, we spawned a root shell.

<figure><img src="/files/ykv4c8cEhH5ddQ7ntzZS" alt=""><figcaption><p>(Amor) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Website revealed potential usernames and weak password hint. Hydra brute force succeeded with `carlota:babygirl`, granting SSH access.

**Exploitation:**\
Found an image on Carlota’s desktop, extracted hidden data with `stegseek` (Base64 → password for `oscar`). Logged in as `oscar`.

**Privilege Escalation:**\
`oscar` had sudo rights on `/usr/bin/ruby`. Using a GTFOBins one-liner, we escalated to root.